The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade lcms2 | Aug 30, 2017 | Feb 3, 2017 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 8 installer 8.25 (JDK 8u152, quarterly CPU) (LTS stream)Apply legacy security update: Azul Zulu JDK 7 installer 7.21 (JDK 7u161, quarterly CPU) — Azul Legacy Production SupportApply Azul Zulu JDK 9 installer 9.0.1 (JDK 9.0.1, PSU) (short-term support); migrate to JDK 11 (LTS) | Feb 3, 2017 | Feb 3, 2017 |
| Centos_linux | — | Upgrade java-1.7.1-ibm-develUpgrade java-1.8.0-ibm-demoUpgrade java-1.7.1-ibm-pluginUpgrade java-1.8.0-ibmUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-develUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.7.1-ibmUpgrade java-1.7.1-ibm-srcUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.7.1-ibm-demoUpgrade satellite-brandingUpgrade satelliteUpgrade java-1.8.0-ibm-plugin | Oct 19, 2017 | Nov 12, 2016 |
| Debian | — | Upgrade lcms2 | Jan 30, 2017 | Jan 29, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade lcms2 | Dec 4, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade lcms2 | Dec 18, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade lcms2 | Nov 19, 2019 | Feb 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for java_oct2017_advisory | Dec 8, 2017 | Dec 7, 2017 |
| Ibm Java | — | Upgrade IBM Java to version 7.1.4.15Upgrade IBM Java to version 8.0.5.5Upgrade IBM Java to version 7.0.10.15 | Oct 5, 2018 | Feb 3, 2017 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 18, 2017 | Feb 3, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 3, 2017 |
| Redhat_linux | — | Upgrade java-1.7.1-ibm-pluginUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.7.1-ibmUpgrade java-1.8.0-ibm-develUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.7.1-ibm-demoUpgrade java-1.8.0-ibmNo solution existsUpgrade java-1.7.1-ibm-develUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-demoUpgrade java-1.7.1-ibm-srcUpgrade java-1.8.0-ibm-plugin | Feb 3, 2017 | Jan 29, 2017 |
| Suse | — | Upgrade java-1_7_1-ibm-alsaUpgrade java-1_8_0-openjdk-headlessUpgrade java-1_7_1-ibm-develUpgrade java-1_7_0-ibmUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_7_1-ibm-jdbcUpgrade liblcms2-2Upgrade java-1_7_1-ibm-pluginUpgrade java-1_8_0-ibm-pluginUpgrade java-1_7_0-openjdk-headlessUpgrade java-1_7_0-openjdk-develUpgrade java-1_8_0-ibm-develUpgrade java-1_7_0-openjdk-demoUpgrade java-1_8_0-openjdk-demoUpgrade java-1_7_1-ibmUpgrade liblcms2-develUpgrade java-1_7_0-ibm-alsaUpgrade liblcms2-2-32bitUpgrade java-1_8_0-openjdkUpgrade java-1_8_0-ibm-alsaUpgrade java-1_8_0-openjdk-develUpgrade java-1_7_0-ibm-develUpgrade java-1_7_0-openjdkUpgrade java-1_8_0-ibmUpgrade java-1_7_0-ibm-pluginUpgrade lcms2 | Nov 10, 2017 | Jan 29, 2017 |
| Ubuntu | — | Upgrade liblcms1Upgrade liblcms-utilsUpgrade liblcms2-2Upgrade liblcms2-utils | Oct 2, 2018 | Jan 29, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub